@openwop/cli 1.5.0 → 1.6.0

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.5.0",
+  version: "1.6.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1209,6 +1209,14 @@ function hostRootFor(path, roots) {
   }
   return best === null ? null : `${roots[best]}${path.slice(best.length)}`;
 }
+function hostSurfaceAdvertised(discovery, v1Prefix) {
+  if (!discovery || typeof discovery !== "object") return false;
+  const { paths, extensions } = discovery;
+  if (paths !== null && typeof paths === "object") {
+    return Object.keys(paths).some((p) => p.startsWith(v1Prefix));
+  }
+  return hostRootFor(v1Prefix, hostRootsFrom(extensions)) !== null;
+}
 async function negotiateMajor(ctx) {
   if (ctx.protocolMajor !== void 0) return ctx.protocolMajor;
   const pinned = ctx.env?.OPENWOP_PROTOCOL_MAJOR;
@@ -16898,8 +16906,8 @@ var APPROVALS_ROUTES = [
 var APPROVALS_HELP = `Usage:
   openwop approvals list [--status pending|approved|rejected] [--json]
   openwop approvals get <approvalId> [--json]
-  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
-  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
+  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
   openwop approvals sla-policy [--json]
   openwop approvals sla-policy set (--enabled | --disabled) [--remind-after-ms n] [--escalate-after-ms n] [--expire-after-ms n] [--json]
   openwop approvals email-pref [--json]
@@ -16937,6 +16945,11 @@ Endpoints:
   --acted-for <s>      (claim/reject) As a delegate covering several people, whose approval this is.
   --expected-hash <h>  (claim/reject) The definition hash you reviewed (composed-workflow proposals;
                        the host refuses the decision if the proposal changed since).
+  --content-hash <h>   (claim/reject) The contentHash of the assistant-action card you reviewed
+                       (\`approvals get\` prints it under the card). REQUIRED to claim an
+                       assistant action (ADR 0862): the host refuses a claim without it (exit 2),
+                       and refuses one whose action changed since you read it (exit 1; re-read
+                       it with \`approvals get\` and review the new card).
   --status <s>   (list) Filter the queue: pending | approved | rejected (default: all).
   --note <text>  (claim/reject) Optional human note recorded with the decision.
   --json         Print the raw host response instead of the rendered view.
@@ -16953,6 +16966,8 @@ Examples:
   openwop approvals list --status pending
   openwop approvals get appr_123 --json
   openwop approvals claim appr_123 --note "LGTM, ship it"
+  openwop approvals get appr_456                      # an assistant action: read the card
+  openwop approvals claim appr_456 --content-hash 9f2c\u2026   # \u2026then approve exactly what you read
   openwop approvals reject appr_123 --note "out of policy"
 
 Teams approval delivery:
@@ -16999,8 +17014,7 @@ function exitForStatus(status) {
 async function ensureApprovalsAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/approvals"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/approvals");
   if (!advertised) {
     throw new CliError(
       "approvals: this host does not advertise the approval-inbox surface (/v1/host/openwop-app/approvals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -17085,12 +17099,31 @@ async function runApprovalsGet(ctx, argv) {
   if (approval.resolvedAt) writeLine(ctx.io.stdout, `resolvedAt: ${approval.resolvedAt}`);
   if (approval.runId) writeLine(ctx.io.stdout, `runId: ${approval.runId}`);
   if (approval.note) writeLine(ctx.io.stdout, `note: ${approval.note}`);
+  if (approval.action && typeof approval.action === "object") renderActionCard(ctx, approval.action);
   return exitForStatus(approval.status);
 }
+function renderActionCard(ctx, action) {
+  writeLine(ctx.io.stdout, "action:");
+  if (action.actionId) writeLine(ctx.io.stdout, `  actionId: ${action.actionId}`);
+  if (action.kind) writeLine(ctx.io.stdout, `  kind: ${action.kind}`);
+  if (action.riskLevel) writeLine(ctx.io.stdout, `  riskLevel: ${action.riskLevel}`);
+  if (action.reason) writeLine(ctx.io.stdout, `  reason: ${action.reason}`);
+  if (typeof action.draft === "string" && action.draft.length) writeLine(ctx.io.stdout, `  draft: ${action.draft}`);
+  if (action.payload && typeof action.payload === "object") {
+    for (const [k, v] of Object.entries(action.payload)) {
+      writeLine(ctx.io.stdout, `  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+    }
+  }
+  if (action.contentHash) writeLine(ctx.io.stdout, `  contentHash: ${action.contentHash}   (claim with --content-hash ${action.contentHash})`);
+}
+function detailsOf(body) {
+  const d = body && typeof body === "object" ? body.details : void 0;
+  return d && typeof d === "object" ? d : {};
+}
 async function runApprovalsResolve(ctx, argv, verb) {
-  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash"] });
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash", "--content-hash"] });
   if (options.help || positionals.length !== 1) {
-    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
 `);
     return options.help ? 0 : 2;
   }
@@ -17100,11 +17133,25 @@ async function runApprovalsResolve(ctx, argv, verb) {
   if (options.note !== void 0) decision.note = options.note;
   if (options.actedFor !== void 0) decision.actedFor = options.actedFor;
   if (options.expectedHash !== void 0) decision.expectedDefinitionHash = options.expectedHash;
+  if (options.contentHash !== void 0) decision.expectedContentHash = options.contentHash;
   const body = Object.keys(decision).length ? decision : void 0;
   let res;
   try {
     res = await requestJson(ctx, path, { method: "POST", ...body !== void 0 ? { body } : {} });
   } catch (err) {
+    if (err instanceof HttpError && err.status === 409 && detailsOf(err.body).reason === "action_changed") {
+      const now = detailsOf(err.body).contentHash;
+      throw new CliError(
+        `approvals: the action behind ${positionals[0]} changed since you reviewed it \u2014 nothing was ${verb === "claim" ? "approved" : "rejected"}. Re-read it with \`openwop approvals get ${positionals[0]}\`${now ? ` (its card now hashes to ${now})` : ""} and decide on what it says now.`,
+        1
+      );
+    }
+    if (err instanceof HttpError && err.status === 400 && detailsOf(err.body).reason === "content_hash_required") {
+      throw new CliError(
+        `approvals: ${positionals[0]} is an assistant action \u2014 read its card with \`openwop approvals get ${positionals[0]}\`, then pass the contentHash it shows: --content-hash <hash>.`,
+        2
+      );
+    }
     if (err instanceof HttpError && err.status === 409) {
       const status = err.body?.status;
       throw new CliError(`approvals: ${positionals[0]} is already ${status ?? "resolved"} \u2014 the host rejected a second decision.`, 1);
@@ -17986,8 +18033,7 @@ Run \`openwop connections --help\` for usage.`);
 async function ensureAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/connections"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/connections");
   if (!advertised) {
     throw new CliError(
       "connections: this host does not advertise the connections surface (/v1/host/openwop-app/connections is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -19396,8 +19442,7 @@ Run \`openwop workforces --help\` for usage.`);
 async function ensureAdvertised2(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/workforces"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/workforces");
   if (!advertised) {
     throw new CliError(
       "workforces: this host does not advertise the workforces surface (/v1/host/openwop-app/workforces is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -30944,6 +30989,7 @@ export {
   getChannelPlugin,
   hostRootFor,
   hostRootsFrom,
+  hostSurfaceAdvertised,
   idempotencyHeaders,
   isNoCredentialChallenge,
   isTerminalRunEvent,

package/dist/openwop.js

@@ -579,7 +579,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.5.0",
+  version: "1.6.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1209,6 +1209,14 @@ function hostRootFor(path, roots) {
   }
   return best === null ? null : `${roots[best]}${path.slice(best.length)}`;
 }
+function hostSurfaceAdvertised(discovery, v1Prefix) {
+  if (!discovery || typeof discovery !== "object") return false;
+  const { paths, extensions } = discovery;
+  if (paths !== null && typeof paths === "object") {
+    return Object.keys(paths).some((p) => p.startsWith(v1Prefix));
+  }
+  return hostRootFor(v1Prefix, hostRootsFrom(extensions)) !== null;
+}
 async function negotiateMajor(ctx) {
   if (ctx.protocolMajor !== void 0) return ctx.protocolMajor;
   const pinned = ctx.env?.OPENWOP_PROTOCOL_MAJOR;
@@ -16898,8 +16906,8 @@ var APPROVALS_ROUTES = [
 var APPROVALS_HELP = `Usage:
   openwop approvals list [--status pending|approved|rejected] [--json]
   openwop approvals get <approvalId> [--json]
-  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
-  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
+  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
   openwop approvals sla-policy [--json]
   openwop approvals sla-policy set (--enabled | --disabled) [--remind-after-ms n] [--escalate-after-ms n] [--expire-after-ms n] [--json]
   openwop approvals email-pref [--json]
@@ -16937,6 +16945,11 @@ Endpoints:
   --acted-for <s>      (claim/reject) As a delegate covering several people, whose approval this is.
   --expected-hash <h>  (claim/reject) The definition hash you reviewed (composed-workflow proposals;
                        the host refuses the decision if the proposal changed since).
+  --content-hash <h>   (claim/reject) The contentHash of the assistant-action card you reviewed
+                       (\`approvals get\` prints it under the card). REQUIRED to claim an
+                       assistant action (ADR 0862): the host refuses a claim without it (exit 2),
+                       and refuses one whose action changed since you read it (exit 1; re-read
+                       it with \`approvals get\` and review the new card).
   --status <s>   (list) Filter the queue: pending | approved | rejected (default: all).
   --note <text>  (claim/reject) Optional human note recorded with the decision.
   --json         Print the raw host response instead of the rendered view.
@@ -16953,6 +16966,8 @@ Examples:
   openwop approvals list --status pending
   openwop approvals get appr_123 --json
   openwop approvals claim appr_123 --note "LGTM, ship it"
+  openwop approvals get appr_456                      # an assistant action: read the card
+  openwop approvals claim appr_456 --content-hash 9f2c\u2026   # \u2026then approve exactly what you read
   openwop approvals reject appr_123 --note "out of policy"
 
 Teams approval delivery:
@@ -16999,8 +17014,7 @@ function exitForStatus(status) {
 async function ensureApprovalsAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/approvals"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/approvals");
   if (!advertised) {
     throw new CliError(
       "approvals: this host does not advertise the approval-inbox surface (/v1/host/openwop-app/approvals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -17085,12 +17099,31 @@ async function runApprovalsGet(ctx, argv) {
   if (approval.resolvedAt) writeLine(ctx.io.stdout, `resolvedAt: ${approval.resolvedAt}`);
   if (approval.runId) writeLine(ctx.io.stdout, `runId: ${approval.runId}`);
   if (approval.note) writeLine(ctx.io.stdout, `note: ${approval.note}`);
+  if (approval.action && typeof approval.action === "object") renderActionCard(ctx, approval.action);
   return exitForStatus(approval.status);
 }
+function renderActionCard(ctx, action) {
+  writeLine(ctx.io.stdout, "action:");
+  if (action.actionId) writeLine(ctx.io.stdout, `  actionId: ${action.actionId}`);
+  if (action.kind) writeLine(ctx.io.stdout, `  kind: ${action.kind}`);
+  if (action.riskLevel) writeLine(ctx.io.stdout, `  riskLevel: ${action.riskLevel}`);
+  if (action.reason) writeLine(ctx.io.stdout, `  reason: ${action.reason}`);
+  if (typeof action.draft === "string" && action.draft.length) writeLine(ctx.io.stdout, `  draft: ${action.draft}`);
+  if (action.payload && typeof action.payload === "object") {
+    for (const [k, v] of Object.entries(action.payload)) {
+      writeLine(ctx.io.stdout, `  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+    }
+  }
+  if (action.contentHash) writeLine(ctx.io.stdout, `  contentHash: ${action.contentHash}   (claim with --content-hash ${action.contentHash})`);
+}
+function detailsOf(body) {
+  const d = body && typeof body === "object" ? body.details : void 0;
+  return d && typeof d === "object" ? d : {};
+}
 async function runApprovalsResolve(ctx, argv, verb) {
-  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash"] });
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash", "--content-hash"] });
   if (options.help || positionals.length !== 1) {
-    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
 `);
     return options.help ? 0 : 2;
   }
@@ -17100,11 +17133,25 @@ async function runApprovalsResolve(ctx, argv, verb) {
   if (options.note !== void 0) decision.note = options.note;
   if (options.actedFor !== void 0) decision.actedFor = options.actedFor;
   if (options.expectedHash !== void 0) decision.expectedDefinitionHash = options.expectedHash;
+  if (options.contentHash !== void 0) decision.expectedContentHash = options.contentHash;
   const body = Object.keys(decision).length ? decision : void 0;
   let res;
   try {
     res = await requestJson(ctx, path, { method: "POST", ...body !== void 0 ? { body } : {} });
   } catch (err) {
+    if (err instanceof HttpError && err.status === 409 && detailsOf(err.body).reason === "action_changed") {
+      const now = detailsOf(err.body).contentHash;
+      throw new CliError(
+        `approvals: the action behind ${positionals[0]} changed since you reviewed it \u2014 nothing was ${verb === "claim" ? "approved" : "rejected"}. Re-read it with \`openwop approvals get ${positionals[0]}\`${now ? ` (its card now hashes to ${now})` : ""} and decide on what it says now.`,
+        1
+      );
+    }
+    if (err instanceof HttpError && err.status === 400 && detailsOf(err.body).reason === "content_hash_required") {
+      throw new CliError(
+        `approvals: ${positionals[0]} is an assistant action \u2014 read its card with \`openwop approvals get ${positionals[0]}\`, then pass the contentHash it shows: --content-hash <hash>.`,
+        2
+      );
+    }
     if (err instanceof HttpError && err.status === 409) {
       const status = err.body?.status;
       throw new CliError(`approvals: ${positionals[0]} is already ${status ?? "resolved"} \u2014 the host rejected a second decision.`, 1);
@@ -17986,8 +18033,7 @@ Run \`openwop connections --help\` for usage.`);
 async function ensureAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/connections"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/connections");
   if (!advertised) {
     throw new CliError(
       "connections: this host does not advertise the connections surface (/v1/host/openwop-app/connections is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -19396,8 +19442,7 @@ Run \`openwop workforces --help\` for usage.`);
 async function ensureAdvertised2(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/workforces"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/workforces");
   if (!advertised) {
     throw new CliError(
       "workforces: this host does not advertise the workforces surface (/v1/host/openwop-app/workforces is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/cli",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   "license": "Apache-2.0",
   "type": "module",